I am wanting to scan a site (which I do not own) to see if they are vulnerable to anything like Heartbleed or the POODLE attack, not because I want to exploit any such vulnerabilities for malicious purposes, but because I want to inform the site owner of any possible vulnerabilities in their site which may need to be looked into.
But what is the legality of using the SSLLabs SSL Server Test to determine if there are any vulnerabilities in the site (in order to report them) without the site owner's prior permission? As I understand that certain more intrusive scans are only legal with the prior permission of the site owner, I also understand that attempting to detect whether a site is, say, vulnerable to Hearbleed or not can have some legal issues. So is it legal for me to scan a site with this tool in order to report any weaknesses to the site owner, or should I seek prior permission from them first? I am in the UK, but the site that I want to scan is hosted in the US.